ResetTicket
Corex\Profile\Reset\ResetTicket · class · Add-ons layer
Where a reset key is kept between the email’s link and the new-password form: a cookie of this browser’s session that scripts cannot read. It is how wp-login.php does it, and for the same reason. Left in the address, the key is in the browser’s history and is read by every script the page loads; an account page of a client’s site loads scripts wp-login.php does not (DECISIONS #341).
Public API
Section titled “Public API”name(): string
Section titled “name(): string”keep(string $login, string $key): void
Section titled “keep(string $login, string $key): void”held(): ?array
Section titled “held(): ?array”The login and the key, cleaned here: a cookie is whatever the browser sends.